Solaris flaw being 'actively exploited'

The Computer Emergency Response Team (Cert) has issued an alert warning administrators that a Solaris security flaw identified in November is being exploited.

Working in conjunction with the Honeynet Project, Cert said that it had recently received "credible reports of an exploit for Solaris systems" and that a vulnerability identified in Cert Advisory 31 "is being actively exploited".

The vulnerability lies in the Common Desktop Environment (CDE) graphical user interface for *nix systems. There is a remotely exploitable buffer overflow flaw in the CDE Subprocess Control Service, known as 'dtspcd', which accepts requests from clients to execute commands and launch applications remotely.

As a result, "a malicious client can manipulate data sent to dtspcd and cause a buffer overflow, potentially executing code with root privileges", Cert has warned.

Recent network traces provided by Honeynet found that one of its servers had been compromised by such an exploit. It is thought that this may be the first reported incident of this vulnerability being exploited in the wild.

The original Cert advisory can be found here and the most recent warning can be found here.